Fix auth, validation, and dashboard stats bugs

app/api/announcements/[id]/route.ts

@@ -4,7 +4,7 @@ import mongoose from 'mongoose'
 import { connectDB } from '@/lib/mongodb'
 import { Announcement } from '@/models/Announcement'
 
-const ALLOWED_FIELDS = ['title', 'content', 'body', 'audience', 'category', 'pinned', 'expiresAt']
+const ALLOWED_FIELDS = ['title', 'content', 'audience', 'category', 'pinned']
 
 export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
   const { userId } = await auth()
@@ -36,7 +36,7 @@ export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string
     }
 
     const announcement = await Announcement.findOneAndUpdate(
-      { _id: id },
+      { _id: id, teacherId: userId },
       { $set: sanitizedBody },
       { new: true, runValidators: true, context: 'query' }
     )
@@ -63,7 +63,7 @@ export async function DELETE(_req: NextRequest, ctx: { params: Promise<{ id: str
     }
 
     await connectDB()
-    const deleted = await Announcement.findOneAndDelete({ _id: id })
+    const deleted = await Announcement.findOneAndDelete({ _id: id, teacherId: userId })
 
     if (!deleted) {
       return NextResponse.json({ error: 'Not found' }, { status: 404 })

app/api/assignments/[id]/route.ts

@@ -4,7 +4,7 @@ import mongoose from 'mongoose'
 import { connectDB } from '@/lib/mongodb'
 import { Assignment } from '@/models/Assignment'
 
-const ALLOWED_UPDATE_FIELDS = ['title', 'description', 'dueDate', 'deadline', 'subject', 'class', 'status', 'kanbanStatus', 'maxMarks']
+const ALLOWED_UPDATE_FIELDS = ['title', 'description', 'deadline', 'subject', 'class', 'status', 'kanbanStatus', 'maxMarks']
 
 export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
   const { userId } = await auth()
@@ -36,9 +36,9 @@ export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string
     }
 
     const assignment = await Assignment.findOneAndUpdate(
-      { _id: id },
-      sanitizedBody,
-      { new: true }
+      { _id: id, teacherId: userId },
+      { $set: sanitizedBody },
+      { new: true, runValidators: true, context: 'query' }
     )
     if (!assignment) return NextResponse.json({ error: 'Not found' }, { status: 404 })
     return NextResponse.json(assignment)
@@ -63,7 +63,7 @@ export async function DELETE(_req: NextRequest, ctx: { params: Promise<{ id: str
     }
 
     await connectDB()
-    const deleted = await Assignment.findOneAndDelete({ _id: id })
+    const deleted = await Assignment.findOneAndDelete({ _id: id, teacherId: userId })
 
     if (!deleted) {
       return NextResponse.json({ error: 'Not found' }, { status: 404 })

app/api/assignments/route.ts

@@ -52,7 +52,7 @@ export async function GET(req: NextRequest) {
     if (error instanceof Error) {
       console.error('GET /api/assignments error:', error.message)
     }
-    return NextResponse.json({ error: error instanceof Error ? error.stack : 'Internal server error' }, { status: 500 })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
 }
 

app/api/attendance/route.ts

@@ -110,6 +110,12 @@ export async function POST(req: NextRequest) {
 
     // Support both single and bulk
     const isBulk = Array.isArray(body)
+    if (isBulk && body.length === 0) {
+      return NextResponse.json(
+        { error: "Bulk payload must include at least one record" },
+        { status: 400 },
+      );
+    }
     if (isBulk && body.length > 500) {
       return NextResponse.json(
         { error: "Bulk payload exceeds maximum of 500 records" },

app/api/grades/[id]/route.ts

@@ -4,7 +4,18 @@ import mongoose from 'mongoose'
 import { connectDB } from '@/lib/mongodb'
 import { Grade } from '@/models/Grade'
 
-const ALLOWED_UPDATE_FIELDS = ['marks', 'maxMarks', 'grade']
+const ALLOWED_UPDATE_FIELDS = ['marks', 'maxMarks']
+
+function calcGrade(marks: number, max: number): string {
+  const pct = (marks / max) * 100
+  if (pct >= 90) return 'A+'
+  if (pct >= 80) return 'A'
+  if (pct >= 70) return 'B+'
+  if (pct >= 60) return 'B'
+  if (pct >= 50) return 'C'
+  if (pct >= 40) return 'D'
+  return 'F'
+}
 
 export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
   const { userId } = await auth()
@@ -15,7 +26,7 @@ export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string
 
     // Validate ObjectId
     if (!mongoose.Types.ObjectId.isValid(id)) {
-      return NextResponse.json({ error: 'Not found' }, { status: 404 })
+      return NextResponse.json({ error: 'Invalid id' }, { status: 400 })
     }
 
     let body
@@ -34,10 +45,30 @@ export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string
     }
 
     await connectDB()
+    const existing = await Grade.findOne({ _id: id, teacherId: userId }).lean()
+    if (!existing) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+    const updatePayload: Record<string, unknown> = { ...sanitizedBody }
+    const hasMarks = 'marks' in updatePayload
+    const hasMaxMarks = 'maxMarks' in updatePayload
+    if (hasMarks || hasMaxMarks) {
+      const nextMarks = hasMarks ? Number(updatePayload.marks) : existing.marks
+      const nextMaxMarks = hasMaxMarks ? Number(updatePayload.maxMarks) : existing.maxMarks
+      if ((hasMarks && Number.isNaN(nextMarks)) || (hasMaxMarks && Number.isNaN(nextMaxMarks))) {
+        return NextResponse.json({ error: 'marks and maxMarks must be numbers' }, { status: 400 })
+      }
+      if (nextMarks > nextMaxMarks) {
+        return NextResponse.json({ error: 'marks must be less than or equal to maxMarks' }, { status: 400 })
+      }
+      if (hasMarks) updatePayload.marks = nextMarks
+      if (hasMaxMarks) updatePayload.maxMarks = nextMaxMarks
+      updatePayload.grade = calcGrade(nextMarks, nextMaxMarks)
+    }
+
     const grade = await Grade.findOneAndUpdate(
-      { _id: id },
-      sanitizedBody,
-      { new: true }
+      { _id: id, teacherId: userId },
+      { $set: updatePayload },
+      { new: true, runValidators: true, context: 'query' }
     )
     if (!grade) return NextResponse.json({ error: 'Not found' }, { status: 404 })
     return NextResponse.json(grade)
@@ -55,8 +86,13 @@ export async function DELETE(_req: NextRequest, ctx: { params: Promise<{ id: str
 
   try {
     const { id } = await ctx.params
+
+    if (!mongoose.Types.ObjectId.isValid(id)) {
+      return NextResponse.json({ error: 'Invalid id' }, { status: 400 })
+    }
+
     await connectDB()
-    const deleted = await Grade.findOneAndDelete({ _id: id })
+    const deleted = await Grade.findOneAndDelete({ _id: id, teacherId: userId })
 
     if (!deleted) {
       return NextResponse.json({ error: 'Grade not found' }, { status: 404 })

app/api/grades/route.ts

@@ -9,10 +9,10 @@ const GradeSchema = z.object({
   studentName: z.string().min(1),
   subject: z.string().min(1),
   marks: z.number().min(0),
-  maxMarks: z.number().min(1).optional(),
+  maxMarks: z.number().min(1).default(100),
   term: z.string().optional(),
 }).refine(
-  (data) => !data.maxMarks || data.marks <= data.maxMarks,
+  (data) => data.marks <= data.maxMarks,
   {
     message: 'marks must be less than or equal to maxMarks',
     path: ['marks'],
@@ -21,7 +21,7 @@ const GradeSchema = z.object({
 
 function calcGrade(marks: number, max: number): string {
   const pct = (marks / max) * 100
-  if (pct > 90) return 'A+'
+  if (pct >= 90) return 'A+'
   if (pct >= 80) return 'A'
   if (pct >= 70) return 'B+'
   if (pct >= 60) return 'B'
@@ -48,7 +48,7 @@ export async function GET(req: NextRequest) {
     return NextResponse.json(grades)
   } catch (error) {
     console.error('GET /api/grades error:', error instanceof Error ? error.message : error)
-    return NextResponse.json({ error: error instanceof Error ? error.stack : 'Internal server error' }, { status: 500 })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
 }
 
@@ -70,19 +70,19 @@ export async function POST(req: NextRequest) {
     if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 })
 
     const data = parsed.data
-    const max = data.maxMarks!
-    const term = data.term ?? 'Term 1'
+    const maxMarks = data.maxMarks
+    const term = data.term?.trim() || 'Term 1'
 
-    const grade = Grade.findOneAndUpdate(
+    const grade = await Grade.findOneAndUpdate(
       { teacherId: userId, studentId: data.studentId, subject: data.subject, term },
-      { $set: { ...data, term, teacherId: userId, grade: calcGrade(data.marks, max) } },
-      { upsert: true, new: true }
+      { $set: { ...data, term, maxMarks, teacherId: userId, grade: calcGrade(data.marks, maxMarks) } },
+      { upsert: true, new: true, runValidators: true, context: 'query' }
     )
     return NextResponse.json(grade, { status: 201 })
   } catch (error) {
     if (error instanceof Error) {
       console.error('POST /api/grades error:', error.message)
     }
-    return NextResponse.json({ error: error instanceof Error ? error.stack : 'Internal server error' }, { status: 500 })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
 }

app/api/profile/route.ts

@@ -4,15 +4,14 @@ import { connectDB } from '@/lib/mongodb'
 import { Teacher } from '@/models/Teacher'
 
 export async function GET(req: NextRequest) {
+  const { userId } = await auth()
+  if (!userId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
   const { searchParams } = new URL(req.url)
   const queryUserId = searchParams.get('userId')
-
-  let userId: string | null = queryUserId
-  if (!userId) {
-    const session = await auth()
-    userId = session.userId
+  if (queryUserId && queryUserId !== userId) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
-  if (!userId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
   try {
     await connectDB()

app/api/students/[id]/route.ts

@@ -4,7 +4,7 @@ import mongoose from 'mongoose'
 import { connectDB } from '@/lib/mongodb'
 import { Student } from '@/models/Student'
 
-const ALLOWED_UPDATE_FIELDS = ['name', 'email', 'grade', 'rollNo', 'class', 'phone', 'address', 'parentName', 'parentPhone']
+const ALLOWED_UPDATE_FIELDS = ['name', 'email', 'rollNo', 'class', 'phone', 'address', 'parentName', 'parentPhone']
 
 export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
   const { userId } = await auth()
@@ -35,9 +35,9 @@ export async function PUT(req: NextRequest, ctx: { params: Promise<{ id: string
 
     await connectDB()
     const student = await Student.findOneAndUpdate(
-      { _id: id },
-      sanitizedBody,
-      { new: true }
+      { _id: id, teacherId: userId },
+      { $set: sanitizedBody },
+      { new: true, runValidators: true, context: 'query' }
     )
     if (!student) return NextResponse.json({ error: 'Not found' }, { status: 404 })
     return NextResponse.json(student)
@@ -65,7 +65,7 @@ export async function DELETE(_req: NextRequest, ctx: { params: Promise<{ id: str
     }
 
     await connectDB()
-    const deleted = await Student.findOneAndDelete({ _id: id })
+    const deleted = await Student.findOneAndDelete({ _id: id, teacherId: userId })
 
     if (!deleted) {
       return NextResponse.json({ error: 'Student not found' }, { status: 404 })

app/api/students/route.ts

@@ -92,9 +92,12 @@ export async function POST(req: NextRequest) {
       return NextResponse.json({ error: 'Malformed JSON' }, { status: 400 })
     }
 
-    StudentSchema.safeParse(body)
+    const parsed = StudentSchema.safeParse(body)
+    if (!parsed.success) {
+      return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 })
+    }
 
-    const student = await Student.create({ ...(body as Record<string, unknown>), teacherId: userId })
+    const student = await Student.create({ ...parsed.data, teacherId: userId })
     return NextResponse.json(student, { status: 201 })
   } catch (error) {
     if (error instanceof Error) {

app/dashboard/OverviewClient.tsx

@@ -189,27 +189,39 @@ export function OverviewClient() {
       const [
         studentsRes,
         assignmentsRes,
+        assignmentsActiveRes,
         attendanceRes,
         gradesRes,
         announcementsRes,
       ] = await Promise.all([
         fetch("/api/students?limit=5"),
         fetch("/api/assignments"),
+        fetch("/api/assignments?status=active&limit=1"),
         fetch("/api/attendance"),
         fetch("/api/grades"),
         fetch("/api/announcements?limit=5"),
       ]);
 
-      const [students, assignmentsData, attendance, grades, announcements] =
-        await Promise.all([
-          studentsRes.json(),
-          assignmentsRes.json(),
-          attendanceRes.json(),
-          gradesRes.json(),
-          announcementsRes.json(),
-        ]);
+      const [
+        students,
+        assignmentsData,
+        assignmentsActiveData,
+        attendance,
+        grades,
+        announcements,
+      ] = await Promise.all([
+        studentsRes.json(),
+        assignmentsRes.json(),
+        assignmentsActiveRes.json(),
+        attendanceRes.json(),
+        gradesRes.json(),
+        announcementsRes.json(),
+      ]);
 
       const assignments = assignmentsData.assignments ?? assignmentsData;
+      const assignmentsTotal = assignmentsData.total ?? assignments.length;
+      const pendingAssignments = assignmentsActiveData.total ??
+        (assignmentsActiveData.assignments ?? assignmentsActiveData ?? []).length;
 
       // ── Attendance ──
       const dateMap: Record<
@@ -316,13 +328,9 @@ export function OverviewClient() {
         .slice(0, 5);
 
       setStats({
-        totalStudents: students.students?.length ?? 0,
-        totalAssignments: Array.isArray(assignments)
-          ? assignments.length
-          : (assignments.length ?? 0),
-        pendingAssignments: assignments.filter(
-          (a: { status: string }) => a.status === "active",
-        ).length,
+        totalStudents: students.total ?? students.students?.length ?? 0,
+        totalAssignments: assignmentsTotal,
+        pendingAssignments,
         attendancePct,
         attendanceBreakdown: {
           present: totalPresent,

app/dashboard/assignments/AssignmentsClient.tsx

@@ -344,7 +344,7 @@ export function AssignmentsClient() {
       description: a.description,
       subject: a.subject,
       class: a.class,
-      deadline: a.deadline,
+      deadline: a.deadline ? a.deadline.slice(0, 10) : "",
       maxMarks: a.maxMarks,
     });
     setModalOpen(true);
@@ -356,10 +356,18 @@ export function AssignmentsClient() {
       : "/api/assignments";
     const method = editing ? "PUT" : "POST";
     try {
+      const normalizedMaxMarks = Number.isFinite(data.maxMarks)
+        ? Number(data.maxMarks)
+        : undefined;
       const res = await fetch(url, {
         method,
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ ...data, maxMarks: Number(data.maxMarks) }),
+        body: JSON.stringify({
+          ...data,
+          ...(normalizedMaxMarks !== undefined
+            ? { maxMarks: normalizedMaxMarks }
+            : {}),
+        }),
       });
       if (res.ok) {
         toast(
@@ -387,14 +395,15 @@ export function AssignmentsClient() {
       ),
     );
     try {
-      await fetch(`/api/assignments/${id}`, {
+      const res = await fetch(`/api/assignments/${id}`, {
         method: "PUT",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           kanbanStatus: col,
           status: col === "submitted" ? "closed" : "active",
         }),
       });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
     } catch (error) {
       fetchAssignments();
       toast(